#48226 In MMR, double free coould occur under some special condition
Closed: wontfix Opened by tbordaz.

Symptom:
    In a replicated topology, a authenticated user that have write access on an entry 
    can send a series of operations that crash the server.
    The crash is due to an access to a already freed buffer.
Impact:
    If the user can reproduce the series of operations the crash is systematic.

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1243970

Reviewed by Rich (Thank you!!)

Pushed to master:
193d79d..f5d2445 master -> master
commit a0f8e0f981a046882db299a7a6d6d1c01bc19571
commit f5d24450477f8341261c3e5cb5c54ec1ab83328f

Pushed to 389-ds-base-1.3.4:
9109a57..8600a5e 389-ds-base-1.3.4 -> 389-ds-base-1.3.4
commit bdbc81e62eb8d7b8dfb298c7ba983cf86353fe66
commit 8600a5eabc78848ad1bf0a9c2014823d0cd6cedc

Pushed to 389-ds-base-1.3.3:
0704386..dfcfa55 389-ds-base-1.3.3 -> 389-ds-base-1.3.3
commit de1b027c39e6b80bdfdf02f1a12854587730aff8
commit dfcfa5521e44604991c48808ff613394712b34ee

A leak was found in the patch 0001-Ticket-48226-In-MMR-double-free-coould-occur-under-s.patch​

{{{
==3150== 32 bytes in 1 blocks are definitely lost in loss record 442 of 1,280
==3150== at 0x4A0645D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==3150== by 0x4C61F92: slapi_ch_malloc (ch_malloc.c:113)
==3150== by 0x4C653B1: csnset_add_csn (csnset.c:30)
==3150== by 0x4C6585E: csnset_dup (csnset.c:352)
^^^^^^^^^^
==3150== by 0x4CE4B35: valueset_update_csn_for_valuearray_ext (valueset.c:1420)
==3150== by 0x4C78A04: entry_delete_present_values_wsi.isra.5 (entrywsi.c:811)
==3150== by 0x4C7923E: entry_apply_mod_wsi (entrywsi.c:911)
==3150== by 0x4C7933E: entry_apply_mods_wsi (entrywsi.c:986)
==3150== by 0xA1A9A97: modify_apply_check_expand.isra.1 (ldbm_modify.c:247)
==3150== by 0xA1AB260: ldbm_back_modify (ldbm_modify.c:626)
==3150== by 0x4C9D4DC: op_shared_modify (modify.c:1054)
==3150== by 0x4C9E846: do_modify (modify.c:387)
==3150== by 0x418610: connection_threadmain (connection.c:619)
==3150== by 0x3A84828C2A: _pt_root (ptthread.c:212)
==3150== by 0x3A79407EE4: start_thread (in /usr/lib64/libpthread-2.18.so)
==3150== by 0x3A790F4D1C: clone (in /usr/lib64/libc-2.18.so)
}}}

git patch file (master) -- additinal fix for the memory leak (regression by the previous patch)
0001-Ticket-48226-In-MMR-double-free-coould-occur-under-s.2.patch

Reviewed by Mark (Thank you!!)

Pushed to master:
c2e350e..b26ec67 master -> master
commit b26ec6762fe2b5d37ade59243086cfd2308e8f0a

Pushed to 389-ds-base-1.3.4:
5165d58..4a3efc3 389-ds-base-1.3.4 -> 389-ds-base-1.3.4
commit 4a3efc3330a034fa485f33e453054758561d4cea

Pushed to 389-ds-base-1.3.3:
c7ac0ad..2fecc39 389-ds-base-1.3.3 -> 389-ds-base-1.3.3
commit 2fecc39b47c8a9014cd43218920cb5e176d66740

Metadata Update from @nhosoi:
- Issue assigned to nhosoi
- Issue set to the milestone: 1.3.3.13

0001-Issue-48226-Fix-CI-test.patch

Please review patch

Metadata Update from @mreynolds:
- Custom field component reset
- Custom field reviewstatus adjusted to review (was: ack)
- Issue close_status updated to: None (was: Fixed)

Metadata Update from @firstyear:
- Custom field reviewstatus adjusted to ack (was: review)

cb7b499..ccfc3c3 master -> master
commit ccfc3c3d8156fbd25abaeabfb1e41579c62c1fe3
Author: Mark Reynolds mreynolds@redhat.com
Date: Mon Feb 20 21:48:57 2017 -0500

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/1557

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix

Metadata